1 Topic by ja1999 (edited by ja1999 2023-11-28 09:25:58)

  • Registered: 2023-11-28
  • Posts: 2

Topic: wolfSSL FIPS Ready - make check fails

EDIT: we're using wolfssl 4.8.1

I'm following this guide
https://www.wolfssl.com/docs/fips-ready-user-guide/

After updating verifyCore I make the library again then on 

$ make check

several of the tests fail:

PASS: scripts/external.test
PASS: scripts/openssl.test
FAIL: scripts/google.test
FAIL: scripts/resume.test
FAIL: scripts/crl-revoked.test
PASS: scripts/tls13.test
FAIL: testsuite/testsuite.test
FAIL: scripts/unit.test

Below is the output of ./test-suite.log. Seeing errors about
wolfSSL error: can't load ca file, Please run from wolfSSL home dir

=====================================
   wolfssl 4.8.1: ./test-suite.log
=====================================

# TOTAL: 8
# PASS:  3
# SKIP:  0
# XFAIL: 0
# FAIL:  5
# XPASS: 0
# ERROR: 0

.. contents:: :depth: 2

FAIL: testsuite/testsuite
=========================

------------------------------------------------------------------------------
 wolfSSL version 4.8.1
------------------------------------------------------------------------------
error    test passed!
MEMORY   test passed!
base64   test passed!
base16   test passed!
asn      test passed!
RANDOM   test passed!
MD5      test passed!
SHA      test passed!
SHA-224  test passed!
SHA-256  test passed!
SHA-384  test passed!
SHA-512  test passed!
SHA-3    test passed!
Hash     test passed!
HMAC-MD5 test passed!
HMAC-SHA test passed!
HMAC-SHA224 test passed!
HMAC-SHA256 test passed!
HMAC-SHA384 test passed!
HMAC-SHA512 test passed!
HMAC-SHA3   test passed!
HMAC-KDF    test passed!
GMAC     test passed!
DES      test passed!
DES3     test passed!
AES      test passed!
AES192   test passed!
AES256   test passed!
AES-GCM  test passed!
AES-CCM  test passed!
RSA NOPAD test passed!
RSA      test passed!
DH       test passed!
PWDBASED test passed!
openSSL extra test
OPENSSL  test passed!
OPENSSL (EVP MD) passed!
OPENSSL (PKEY0) passed!
OPENSSL (PKEY1) passed!
OPENSSL (EVP Sign/Verify) passed!
ECC      test passed!
CMAC     test passed!
logging  test passed!
mutex    test passed!
memcb    test passed!
Test complete
wolfSSL error: can't load ca file, Please run from wolfSSL home dir
FAIL testsuite/testsuite.test (exit status: 1)

FAIL: scripts/resume
====================

ready file /home/pi/wolfssl-4.8.1-gplv3-fips-ready/wolfssl_resume_ready9548
-r          Resume session
-e
Starting example server for resume test...

-e
Resume test supported
-e waiting for ready file...
-e waiting for ready file...
wolfSSL error: can't load ca file, Please run from wolfSSL home dir
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e waiting for ready file...
-e NO ready file ending test...
in cleanup
killing server
./scripts/resume.test: 45: kill: No such process

FAIL scripts/resume.test (exit status: 1)

FAIL: scripts/crl-revoked
=========================


Starting example server for crl test...

waiting for ready file...
waiting for ready file...
wolfSSL error: can't load ca file, Please run from wolfSSL home dir
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
waiting for ready file...
NO ready file ending test...
FAIL scripts/crl-revoked.test (exit status: 1)

FAIL: scripts/google
====================

PING www.google.com(den16s08-in-x04.1e100.net (2607:f8b0:400f:804::2004)) 56 data bytes
64 bytes from den16s08-in-x04.1e100.net (2607:f8b0:400f:804::2004): icmp_seq=1 ttl=114 time=10.5 ms
64 bytes from den08s04-in-x04.1e100.net (2607:f8b0:400f:804::2004): icmp_seq=2 ttl=114 time=12.4 ms

--- www.google.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 10.514/11.459/12.405/0.945 ms
wolfSSL error: can't load ca file, Please run from wolfSSL home dir
-e

Client connection failed
FAIL scripts/google.test (exit status: 1)

FAIL: scripts/unit
==================

FAIL scripts/unit.test (exit status: 134)

Share

  • Registered: 2021-08-12
  • Posts: 105

Re: wolfSSL FIPS Ready - make check fails

Hi  ja1999,

Thanks for your interest in wolfSSL.  4.8.1 is a very old version.  I suspect you are bumping into expired certificates in our testing directory.

Have you tried a more recent version of wolfSSL-fips-ready?   5.6.4 is the most recent version and it is available at https://wolfssl.com/download . I tested it recently and it works as expected.

Warm regards, Anthony

Share

  • Registered: 2023-11-28
  • Posts: 2

Re: wolfSSL FIPS Ready - make check fails

Hi Anthony,

Thank you for your help.

That seems very likely then.

Unfortunately our application depends on that version so an upgrade is undesirable at the moment.
Would you expect that we could just grab the certs from 5.6.4 and replace them with the expired certs from 4.8.1 and the tests would pass?

Share

  • Registered: 2021-08-12
  • Posts: 105

Re: wolfSSL FIPS Ready - make check fails

Hi Ja1999,
Yes I suspect that would work.
Warm regards, Anthony

Share